Privacy Policy

This Privacy Policy applies to the yoga apparel store operated by SPORTLINE LLC. It explains what personal data we collect when you browse the store or place an order, why we process it, who receives it, how long we retain it, and how you can exercise your rights.

We are the controller of the personal data described here. Our business is based in the Bronx, New York, and we sell yoga apparel for women and men to customers in the United States and the European Union. Where we offer goods to EU customers or monitor their behaviour there, the GDPR applies alongside U.S. law. Where we process the personal data of California residents, the CCPA/CPRA applies. We do not process the personal data of Kentucky residents at a volume that triggers the Kentucky Consumer Data Protection Act (KCDPA), and this Policy does not describe KCDPA rights.

This Policy is organised around the data flows that exist in a yoga apparel store: the fit and measurement data you may enter to choose a size, the wallet payment data that never reaches our servers, and the order and account record we keep after the sale. It is not a generic template; each section maps a data category to its purpose and, where GDPR applies, its legal basis.

1. Fit and Measurement Data: What We Collect and How We Classify It

Yoga apparel sizing is not streetwear sizing. A women’s M in a compression legging and a men’s M in practice shorts are different body measurements, and a size chart that shows only letters does not tell you which one you are choosing. This section explains what we collect to close that gap, and what we do not infer from it.

1.1 What we collect

When you use a size chart, a “find your size” feature, or a product page, you may give us:

• Your usual size in women’s or men’s sizing, stated separately;
• Your chest, waist, and hip measurements, where a size chart asks for them;
• Your height and inseam, where a legging or short length is size-dependent;
• Your preferred fit (compression, relaxed, high-rise, full-coverage), where you record it in an account;
• For men’s practice wear, the size you normally wear in men’s tops or shorts.

You do not have to provide any of this to browse. It is collected only when you use a fit-related feature or enter it at checkout.

1.2 How we classify it, and what we do not do

Body measurements entered to select a size are commercial fit parameters, not health data. A waist measurement used to choose a legging size is a garment-sizing input, not a diagnosis. We do not treat it as “data concerning health” under GDPR Article 9, as “health information” under the CPRA, or as a “medical condition” under any U.S. state health-privacy framework. We do not use it to infer a medical condition, a body-mass category, or a fitness level.

The classification changes only where you volunteer a health-related statement — for example, that you need a specific compression level because of a medical issue, or that a garment must accommodate a post-surgical restriction. Where you volunteer that information in a customer-service message, we use it only to answer the inquiry. We do not store it as a fit-profile attribute, do not combine it with your order history, and do not use it to infer characteristics about you.

We do not operate a body scanner, a virtual try-on that derives measurements from a photograph, or any tool that creates a biometric template from your body. If we introduce such a feature, we will update this Policy and, where the law requires, obtain separate explicit consent before processing.

Legal basis (GDPR). Where you enter fit data to receive a size recommendation, we process it on the basis of your consent (Art. 6(1)(a)). Where the information is necessary to fulfil an order — the size you selected for the garment you bought — the basis is performance of a contract (Art. 6(1)(b)). You can withdraw consent for fit recommendations at any time by clearing the field or contacting us; withdrawal does not affect the lawfulness of processing before withdrawal.

1.3 What we do not do with fit data

We do not sell fit data. We do not share body measurements with advertising platforms for their own use. We do not use fit data to build a cross-site profile of your body. We do not use it to set individualised prices or to make automated decisions about access to the store.

2. Order and Account Data

What we collect. Full name, shipping address, billing address (where different), email address, telephone number, account login credentials (stored hashed and encrypted), and, for each order, the product, size, colour, price, currency, and order reference.

Why, and on what basis. We use this data to process and deliver the order, manage returns and size exchanges, and provide order-related customer service. GDPR legal basis: performance of a contract (Art. 6(1)(b)); legal obligation for transaction and tax records (Art. 6(1)(c)). Consequence of not providing order data: we cannot process or deliver an order.

Men’s and women’s size fields. Where a style is offered in both men’s and women’s sizing, the order record stores the size system you selected alongside the size, so that a return or exchange does not confuse a men’s M with a women’s M. This is an operational field, not a gender marker, and it is not used for marketing segmentation.

3. Wallet Payment Data and the Zero-Storage Boundary

What we collect. The wallet selected (iDEAL or BLIK), transaction ID and payment reference, authorisation status, amount, currency, timestamp, refund and chargeback status, and limited identifiers returned by the payment service provider.

How the payment flow works. Payment method selection occurs after you click “Place Order.” The system evaluates the shipping destination and order currency and displays the wallet method available for that combination. You are directed to your banking environment to authorise the transaction, and the order moves out of pending status only if authorisation succeeds.

What we do not retain. We do not receive or store your online banking password, wallet login credentials, full payment account number, CVV, or one-time authentication codes. iDEAL and BLIK authorisation takes place in the banking environment; the credential is not transmitted to or retained by us. If you receive a request for such credentials that appears to come from us, do not respond and contact us before taking any other step.

GDPR legal basis. Performance of a contract (Art. 6(1)(b)); legal obligation for transaction records (Art. 6(1)(c)).

4. Automatically Collected Technical Data and Cookies

Technical data. IP address, browser type and version, operating system, device type, referring and exit pages, pages viewed, and general geographic location derived from IP. Why: site security, fraud prevention, and aggregated analytics. GDPR legal basis: legitimate interests (Art. 6(1)(f)); consent where analytics or advertising cookies require it.

Cookies. Essential cookies (cart, checkout, session security) do not require consent. Analytics and advertising cookies are loaded only after you give clear, affirmative consent through the cookie banner. Pre-ticked boxes are not used, and “reject” is presented with the same prominence as “accept.” Silence, scrolling, or continued browsing does not constitute consent. We do not use cookie walls that condition access on accepting non-essential cookies.

GPC and opt-out signals. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of sale or sharing for the browser or device on which it is sent. Under CPPA regulations effective 1 January 2026, a California business must provide a means for the consumer to confirm that an opt-out request, including a GPC signal, has been recognised and processed — a visible indicator such as a badge, toggle, or message, not merely backend handling. We maintain that indicator and test our GPC handling periodically, because ad-tech and vendor changes can break recognition without any change to the policy text.

Consent records are retained for no longer than six months, after which we ask you to reaffirm your preferences. Non-essential cookies expire within a defined period, typically no longer than 24 months.

5. How We Share Data

Payment service providers. The provider that enables iDEAL and BLIK receives the data necessary to authorise and settle the transaction, under its own regulatory obligations.

Logistics and carriers (USPS, FedEx, DHL, and regional last-mile partners). They receive name, shipping address, and, where the carrier requires it, a phone number. They do not receive fit data, body measurements, wallet data, or marketing preferences.

IT, hosting, and analytics providers. They process data on our instructions under data-processing agreements.

Professional advisers and authorities. Where necessary to comply with law or protect rights and safety.

We do not sell personal information. We do not share fit data with advertising partners. Where advertising cookies are used, those tools receive cookie identifiers for measurement and remarketing on our behalf, not for their independent use.

International transfers. Where GDPR applies and we transfer personal data from the EU/EEA to the U.S., we rely on Standard Contractual Clauses approved by the European Commission, supplemented by measures appropriate to the transfer.

6. Retention

Where data is no longer needed, we delete or anonymise it.

7. Your Rights: New York, California, and the EU/EEA

7.1 New York — security safeguards (SHIELD Act)

New York’s SHIELD Act (General Business Law § 899-bb) requires a business that owns or licenses private information of New York residents to develop, implement, and maintain reasonable administrative, technical, and physical safeguards appropriate to its size and the sensitivity of the data it holds. The Act does not create a separate consumer right to access, correct, or delete data, and this Policy does not describe such a right for New York residents.

What the SHIELD Act does require is a security programme. We maintain administrative safeguards (written information-security policy, employee handling rules, vendor oversight), technical safeguards (encryption of data in transit, access controls, hashed storage of account credentials), and physical safeguards (controls over facilities and devices that process order data). Where a breach affects private information of a New York resident, we notify the affected individuals and the relevant regulators as required by GBL § 899-aa, within the timeframe the statute requires.

7.2 California residents — CCPA/CPRA

If you are a California resident, you have the right to:

• Know what personal information is collected, used, and disclosed;
• Delete personal information, subject to legal retention;
• Correct inaccurate personal information;
• Opt out of sale or sharing. We do not sell personal information. Where advertising cookies constitute “sharing,” you can opt out via the “Your California Privacy Choices” link or a GPC signal, and we provide the visible confirmation described in Section 4.
• Limit the use and disclosure of sensitive personal information. We do not use sensitive personal information beyond the purposes necessary to provide the goods or services reasonably expected by you. Body measurements entered to select a yoga apparel size are not sensitive personal information under the CPRA; they are commercial fit parameters, not health information collected and analysed for a health purpose. This Policy states that limitation as the basis for not presenting a separate “Limit the Use of My Sensitive Personal Information” link. If our use changes, we will provide the link and update this Policy.
• Non-discrimination for exercising a right.

You may use an authorised agent to submit a request where the law permits it.

7.3 EU/EEA and UK residents — GDPR / UK GDPR

You have the rights of access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests and to direct marketing), and withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your supervisory authority.

7.4 Automated decision-making

We use automated tools for fraud screening and payment authorisation. These do not produce legal or similarly significant effects based solely on automated processing. If a payment is declined, you may contact us and we will review the order through a human process. We do not use fit or body-measurement data to make automated decisions about credit, access, or pricing.

8. Children

The store is not directed to children under 13, and we do not knowingly collect their personal data. Account creation requires confirmation that the user is at least 18. Where we learn that we have collected personal data from a child under 13 without parental consent, we will delete it promptly. If you believe a minor has provided data, contact us.

9. Contact

Controller: SPORTLINE LLC
1115 Jerome Ave #6B, Bronx, NY 10452, United States
Email: [email protected]
Phone: +1 6462542334
Part number: 20261184325